APT37__2018__Red_Eyes_Hacking_Group_Report.pdf

AhnLab's report documents a multi-year campaign by the Red Eyes actor (aka APT37/Group 123) targeting North Korea-related individuals and organizations using malicious Hangul/Office documents, mobile messenger lures, and exploitation of vulnerabilities including an Adobe Flash zero-day (CVE-2018-4878) and Hangul EPS; malware families include loaders (DocPrint/Reloader), Reloaderx (system enumeration and downloader), Redoor/DogCall backdoors, and destructive wipers, with numerous IoCs (MD5s, PDB strings, C2 URLs) and evidence suggesting ties to an earlier 2015 campaign (Operation ProgamsByMe).